Another Linux Privilege Escalation, Another Working Exploit, This Time Targeting Arch


PinTheft: Another Linux Privilege Escalation, Another Working Exploit, This Time Targeting Arch

Pierluigi Paganini
May 20, 2026

PinTheft is a Linux LPE flaw in the RDS subsystem with public exploit code. Arch Linux users face the highest risk and should patch immediately.

The wave of Linux local privilege escalation vulnerabilities showing up with working exploit code is not slowing down. The latest is PinTheft, discovered by the V12 security team, which affects the Linux kernel’s RDS (Reliable Datagram Sockets) subsystem and already has a public proof-of-concept available. No CVE has been assigned yet, but a patch landed earlier this month.

“PinTheft is a Linux local privilege escalation exploit for an RDS zerocopy double-free that can be turned into a page-cache overwrite through io_uring fixed buffers.” reads the advisory. “The bug lived in the RDS zerocopy send path. rds_message_zcopy_from_user() pins user pages one at a time. If a later page faults, the error path drops the pages it already pinned, and later RDS message cleanup drops them again because the scatterlist entries and entry count remain live after the zcopy notifier is cleared. Each failed zerocopy send can steal one reference from the first page.”

The vulnerability stems from how the kernel handles page references when a zerocopy send operation fails partway through.

A double-free flaw lets attackers gradually steal memory references until they can overwrite the page cache and gain root access. The exploit uses a technique similar to recent Linux LPE bugs like Dirty Frag, Fragnesia, and Copy Fail.

The attack surface here is significantly narrower than some of the other recent LPEs, and that is worth being precise about. PinTheft requires the RDS kernel module to be loaded, io_uring to be enabled, a readable SUID-root binary on the system, and x86_64 architecture for the included payload to work. The experts believe that the combination of conditions, limits exploitation considerably.

The RDS module is the key constraint. As V12 put it in their advisory.

“Sadly, the RDS kernel module this requires is only default on Arch Linux among the common distributions we tested.” continues the advisory.

Ubuntu, Fedora, Debian, and most enterprise Linux distributions do not load RDS by default, which means they are not immediately exposed. Arch Linux users with default kernel configurations are the primary population at risk right now.

Security researcher Will Dormann independently confirmed the exploit works as described on Arch Linux systems.

The kernel fix is already available, anyone running Arch Linux should update to the latest kernel package immediately. That is the clean solution and there is no good reason to delay it.

For situations where an immediate kernel update is genuinely not possible, V12 has provided a quick mitigation that unloads the RDS modules and prevents them from being reloaded:

rmmod rds_tcp rds
printf 'install rds /bin/false\ninstall rds_tcp /bin/false\n' > /etc/modprobe.d/pintheft.conf

This blocks the attack path without requiring a reboot or a kernel update, and it is a reasonable stopgap for systems that need more time before a maintenance window.

PinTheft is arriving at an uncomfortable moment for Linux security. The cluster of page cache write vulnerabilities, Copy Fail, Dirty Frag, Fragnesia, and DirtyDecrypt, has dominated the conversation for weeks, and the situation moved from theoretical to actively exploited when CISA added Copy Fail to its Known Exploited Vulnerabilities catalog on May 1, ordering federal agencies to patch within two weeks. Real attackers are now using at least one of these techniques in the wild.

Whether that reflects a genuine surge in research focus on this area or a broader shift in how these bugs are being discovered and disclosed is an open question, but the operational result is the same: Linux administrators are dealing with a steadily growing list of patching priorities, some of them with working public exploits already attached.

Arch Linux users should patch immediately or disable the RDS modules, as the conditions needed to exploit PinTheft exist by default.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Linux)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews



Intelligent Investing, a research-driven market analysis platform, works from the premise that artificial intelligence can expand financial forecasting by processing large datasets, accelerating strategy development, and enabling systematic execution. Alongside these capabilities, human interpretation remains essential, providing the context needed to translate data into meaningful market perspectives. 

This philosophy is reflected in the work of founder Arnout Ter Schure. With a PhD in environmental sciences and more than a decade of experience in scientific research, Dr. Ter Schure applies an analytical mindset to financial markets. His transition into market analysis reflects a sustained focus on data and repeatable patterns. Over time, he has developed proprietary indicators and a multi-layered analytical framework that integrates technical, sentiment, and cyclical analysis. This foundation provides important context for his perspective on how AI fits into modern financial decision-making.

Financial markets are becoming more complex and fast‑moving, and that shift has sparked a growing interest in how AI can play a supportive role,” Ter Schure states. “This has opened the door to exploring how computational tools might complement and strengthen traditional analytical approaches.” 

According to a study exploring a multi-agent deep learning approach to big data analysis in financial markets, modern AI systems demonstrate strong capabilities in processing large-scale data and identifying patterns across multiple timeframes. When combined with structured methodologies such as the Elliott Wave principle, these systems can enhance analytical efficiency and improve pattern recognition, particularly in high-speed trading environments.

This growing role of AI aligns with Ter Schure’s view of it as a powerful analytical companion, especially in areas where speed and computational precision are required. He explains, “AI excels when the task is clearly defined. If you provide the structure, the parameters, and the objective, it can execute with remarkable speed and precision.” This may include generating trading algorithms, coding strategies, and conducting rapid backtesting across historical datasets.

As these capabilities become more integrated into the analytical process, an important consideration emerges. Ter Schure emphasizes that AI systems function within the boundaries established by human input. He notes that the data they analyze, the assumptions embedded in their programming, and the frameworks they rely upon all originate from human decisions. Without these elements, the system may lack direction and purpose. Ter Schure states, “AI can accelerate the ‘how,’ but it still depends on a human to define the ‘why.’ That distinction applies across every layer of market analysis.

This relationship becomes especially relevant in financial forecasting, where interpretation plays a central role. AI can analyze historical data and identify recurring patterns, yet its perspective remains limited to what has already been observed. The same research notes that even advanced systems encounter challenges during periods of structural change or unprecedented market conditions, where historical data offers limited guidance. In such situations, the ability to interpret evolving conditions becomes as important as computational power.

For Ter Schure, forecasting involves working with probabilities rather than fixed outcomes. AI can assist in outlining potential scenarios, yet it does not determine which outcome will unfold. “Markets evolve through a combination of structure and behavior,” he explains. “A model can highlight patterns, but understanding how those patterns develop in real time still requires human judgment.”

This dynamic also extends to how AI interacts with human assumptions. According to Dr. Ter Schure, since these systems learn from existing data and user inputs, their outputs often reflect the perspectives embedded within that information. As a result, the quality of the initial assumptions plays a significant role in shaping the outcome. “If the initial premise includes a bias, the output often reflects it. The responsibility remains with the analyst to question, refine, and interpret the result,” Ter Schure remarks.

Such considerations become even more important when viewed through the lens of market behavior. Financial markets, as Ter Schure notes, are often influenced by collective sentiment, where emotions such as optimism and caution influence price movements. “Regardless of the computerization of trading, market behaviour has remained constant,” he says. While AI can identify historical expressions of these behaviors, interpreting their significance within a current context typically requires experience and perspective. 

Within this broader context, Arnout’s methodology illustrates how structured human analysis can complement technological tools. His approach combines Fibonacci ratios with the Elliott Wave principle, focusing on wave structures, extensions, and corrective patterns. These frameworks offer a way to interpret market cycles and map potential pathways for price movement. A key element of his method involves incorporating alternative scenarios through double corrections or extensions, allowing for multiple potential outcomes to be evaluated simultaneously.

This multi-scenario framework supports adaptability as market conditions evolve. “Each structure presents more than one pathway,” he explains. “By preparing for those alternatives, you create a framework that evolves with the market as new information becomes available.” This perspective allows for continuous reassessment, where forecasts are refined as additional data emerges.

Ter Schure stresses that although AI can assist in identifying patterns within such frameworks, the interpretation of complex wave structures introduces nuances that extend beyond automated analysis. Multi-layered corrections and extensions often depend on contextual judgment, where small variations influence the broader interpretation.

Overall, Ter Schure suggests that AI serves as an extension of the analytical process, enhancing specific components while leaving interpretive decisions to the analyst. Its ability to execute defined tasks with speed and precision complements the depth of human judgment. He states, “Technology expands what we can do, but understanding determines how we apply it. The combination is where meaningful progress takes place.”



Source link